Business continuity is the programme UK organisations use to keep critical activities running, or restore them within agreed times, after disruption such as fire, flood, cyber attack, utility failure or supply-chain failure. The international requirements standard is ISO 22301:2019, with guidance in ISO 22313:2020. Cognitious is our risk consultancy arm. Its Cognitious risk practice offers emergency preparedness planning, including tabletop and simulation exercises, and our security guarding operations can deliver any guarding a plan calls for. Our security guarding is SIA ACS approved (ref ELSELISC02) and we hold ISO 9001, ISO 14001 and ISO 45001; ACS covers security guarding, not consultancy. Cognitious works with organisations across the UK, including London commercial property.
What five components does a business continuity programme cover?
We group a programme into five components: business impact analysis, recovery strategy, incident response plans, exercising and testing, post-incident review. They follow the order of ISO 22301:2019 clause 8 rather than ad-hoc template content: impact analysis maps to clause 8.2 (business impact analysis and risk assessment) and sets the timeframes for resuming each prioritised activity; recovery strategy maps to clause 8.3; plans map to clause 8.4; exercising maps to clause 8.5; post-incident review maps to clause 8.6 (evaluation) and the improvement clause that follows the performance evaluation clause. The five-part layout is our own grouping, not wording taken from the standard. ISO has flagged ISO 22301:2019 as due for revision, so check which edition applies when you start.
What does a UK commercial-property engagement look like?
We would lay a programme for a commercial-property estate out as a 12-month cycle with milestones at month one, three, six and twelve. As an illustration: month one is the impact-analysis workshop; month six is a tabletop exercise with a scenario pack covering fire, flood, cyber and utility outage; month twelve is a close-out report and a summary you can share with insurers. This is an example, not a method required by ISO 22301:2019, which asks for exercises at planned intervals and does not fix a 12-month calendar.
Why should the engagement name an accountable lead?
A named lead on the cover sheet makes the documentation read as accountable professional advice rather than a vendor template. We would ask any provider, Cognitious included, to name the individual responsible and to show where their experience comes from. If a provider claims a professional credential, check it directly with the body that awards it.
How is the programme measured against ISO 22301:2019?
ISO 22301:2019 requires an organisation to monitor, measure, analyse and evaluate its business continuity performance, but leaves the measures to you. We would start with three: the percentage of processes with a current impact analysis, the percentage of scenarios with a tested plan, and the time taken to restore an activity in an exercise compared with its target. An evidence pack for a review can hold the impact-analysis workbook, recovery-strategy paper, incident response plan register and tabletop exercise log, each with a file reference and an owner sign-off.
The Civil Contingencies Act 2004 is narrower than many guides imply. Section 2 requires listed bodies to maintain plans so they can keep performing their functions in an emergency, and GOV.UK describes that as a duty on Category 1 responders such as the emergency services, local authorities and NHS bodies. Category 2 bodies, including utilities, have lesser duties to co-operate and share information.
How does Cognitious run the engagement?
We publish Cognitious’s work in this area as emergency preparedness: lockdown and evacuation planning, tabletop and simulation exercises and emergency communications, delivered by its in-house consultants, with plans you own and your team runs. It sits between our risk practice and our security guarding operations, and works across the UK including London commercial property. We agree scope, price and timescale with each client rather than fixing them in advance. To start, send us your sector, footprint and the recovery priorities you have in mind at [email protected] or call 0800 085 5022.
What this looks like on a real contract. A plan only works if people reach the site fast. We provide facilities management and security across 20 Engie sites, covering guarding, reception, porters, FM assistants and mail room. That includes an emergency deployment across 5 sites, 24/7, mobilised within hours. It is the delivery side of a plan: people on site quickly when an incident changes what a building needs.
The same applies when a building loses its fire alarm. At Burlington Gate in Walsall we put one officer on site, 24 hours a day, for ten days while a fire alarm fault was repaired. At New Palace Place in Westminster we were on site within four hours, with two officers per shift, 24 hours a day. See waking watch at Burlington Gate, Walsall and waking watch at New Palace Place, Westminster.
Does a commercial property owner have to have a business continuity plan?
Not under the Civil Contingencies Act 2004 in most cases. The Act’s planning duty falls on listed Category 1 responders, and private property owners are generally not among them. A plan is still good practice, and a client, lender or insurer may ask for one, so check your own contracts.
Local authorities are Category 1 responders and must provide advice and assistance to businesses and voluntary organisations about business continuity management, so your council is a free place to start.
Frequently asked questions
Business continuity is a programme that identifies critical activities, sets how quickly each must be restored, and prepares and tests plans to meet those times. ISO 22301:2019 sets the international requirements, with ISO 22313:2020 giving guidance. We group the work into five components: impact analysis, strategy, plans, exercising and post-incident review. The Civil Contingencies Act 2004 planning duty applies to listed Category 1 responders such as emergency services, local authorities and NHS bodies; most private property owners are not listed, so for them a plan is good practice.
ISO 22301:2019 asks for an exercise and testing programme at planned intervals but does not fix a frequency, so you set it from your own risk. We would suggest a yearly exercise as a sensible starting point, with scenarios such as fire, flood, cyber attack and utility outage. Repeat an exercise after a major change to the site or after a real incident, and feed the findings back into the impact analysis.
No. The SIA Approved Contractor Scheme is voluntary and approves companies for activities the SIA licenses: manned guarding (cash and valuables in transit, close protection, door supervision, public space surveillance (CCTV) and security guarding), key holding, and vehicle immobilising in Northern Ireland only. The SIA says it cannot approve consultancy services, so business continuity consultancy sits outside ACS. Our ACS approval (ref ELSELISC02) covers our security guarding.
